Users, groups and sudo

Goal

Create accounts that match a policy (UID, shell, groups, expiry) and delegate precise rights.

Create and modify

useradd -m -s /bin/bash -G wheel,devs -c "Alice Martin" alice
passwd alice
usermod -aG devs alice        # -a is essential: without it, groups are replaced
usermod -L alice; usermod -U alice    # lock / unlock
userdel -r alice              # -r removes the home directory

Password policy

chage -M 90 -m 7 -W 14 alice          # max 90d, min 7d, warn 14d
chage -l alice
chage -d 0 alice                      # force change at next login

Groups

groupadd -g 2000 devs
gpasswd -a alice devs
id alice
getent group devs

sudo

/etc/sudoers.d/devs (edit with visudo -f):

%devs ALL=(root) /usr/bin/systemctl restart httpd
alice ALL=(ALL) NOPASSWD: /usr/bin/dnf update

visudo -c            # VALIDATE syntax: one error breaks sudo for everyone

Never hand out ALL=(ALL) NOPASSWD: ALL without an explicit reason.

Verify

id alice; chage -l alice | head -3; sudo -l -U alice